CVE-2023-5348: 
WordPress vulnerability analysis and mitigation

The Product Catalog Mode For WooCommerce WordPress plugin before version 5.0.3 contains a security vulnerability identified as CVE-2023-5348. The vulnerability was discovered and reported by Krzysztof Zając from CERT PL, and was publicly disclosed on November 21, 2023. This security issue affects WordPress installations using the Product Catalog Mode For WooCommerce plugin versions prior to 5.0.3 (WPScan).

The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue with a CVSS score of 6.1 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The core issue stems from improper authorization of settings updates and inadequate escaping of settings values. This vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation (NVD).

When successfully exploited, this vulnerability allows unauthenticated users to perform stored XSS attacks. The impact is particularly concerning as it enables attackers to inject malicious scripts that can be executed when other users, including administrators, visit affected pages (WPScan).

The vulnerability is exploitable by unauthenticated users when the plugin's "Catalog Mode" is activated. An attacker can exploit this by sending a specially crafted HTTP request to the wp-json/mvx_catalog/v1/save_enquiry endpoint, which allows for arbitrary setting updates without proper authorization (WPScan).

The recommended mitigation is to update the Product Catalog Mode For WooCommerce plugin to version 5.0.3 or later, which contains the security fix for this vulnerability (NVD).